lib/updater: fix invalid hash check for SHA256

This is major problem as packages were not verified thanks to this
error.

This also adds warning for packages not correctly verified.
6 jobs for 3x-fix-invalid-hash
in 2 minutes and 58 seconds and was queued for 9 seconds